Help Needed: Google SSO Integration Error in Production

[JCasimiro]

Hello Google Cloud Community,

I’m seeking advice on a pressing issue we've encountered with our Google Single Sign-On (SSO) integration in production. After functioning seamlessly for several years, the process started failing a few months ago, presenting a "400 Bad Request" error specifically during user sign-in attempts.

Key Points
- The error occurs when users not currently logged into Google attempt to sign in through our SSO, resulting in a "400 Bad Request" message indicating the request is malformed. This problem does not arise for users who are already logged in (on Google).
- Crucially, this malfunction is exclusive to our production environment. In testing and other environments where a different clientID is used, the SSO integration operates flawlessly.

Error Message:

400. That’s an error.
The server cannot process the request because it is malformed. It should not be retried. That’s all we know.

Technical Context:
- The issue surfaces when users are prompted to choose their Google account for SSO.
- Our setup includes an appropriately encoded redirect URI and the SSO request involves openid, profile, and email scopes.
- Notably, our project’s clientID is utilized across two platforms: our main website for SSO and a Google Docs add-in requiring a wider range of scopes.

We recently identified that a crucial scope (https://www.googleapis.com/auth/documents) required by our Google Docs add-in was absent from our OAuth consent screen configuration. Despite the add-in’s continued performance for users (including new ones), and the application being marked as "VERIFIED" on the OAuth Consent Screen, we proceeded to add this missing scope and are currently awaiting Google’s verification. 

Given the integration’s historical reliability and the recent onset of this issue, could the missing scope and the user cap limit be contributing factors to the malfunctioning SSO process for non-logged-in users?

If anyone has insights into the "malformed request" error or suggestions for troubleshooting, your expertise would be invaluable to us.

Thank you in advance for your time and support.